DITEKSHEN_MALWARE_Win_Redlinedropperexe

import "pe"

rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE
{
	meta:
		description = "Detects executables dropping RedLine infostealer"
		author = "ditekSHen"
		id = "364ba540-60a5-5e1b-bb21-505a442eabb6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2461-L2484"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-EXE"

	strings:
		$s1 = "Wizutezinod togeto0Rowadufevomuki futenujilazem jic lefogatenezinor" fullword wide
		$s2 = "6Tatafamobevofaj bizafoju peyovavacoco lizine kezakajuj" fullword wide
		$s3 = "Lawuherusozeru kucu zam0Zorizeyuk lepaposupu gala kinarusot ruvasaxehuwo" fullword wide
		$s4 = "ClearEventLogW" fullword ascii
		$s5 = "ProductionVersion" fullword wide
		$s6 = "Vasuko)Yugenizugilobo toxocivoriye yexozoyohuzeb" wide
		$s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( pe.exports ( "_fgeek@8" ) and 2 of them ) or ( 2 of them and for any i in ( 0 .. pe.number_of_sections ) : ( ( pe.sections [ i ] . name == ".rig" ) ) )
}